Facebook

Hi. We're your new overlords.


Hi. We're Apple.


We are delighted to inform you that regulations require you to carry a device that:

a. Tells us where you are at all times;

b. Records who you talk with, and for how long;

c. Can be used to record exactly what you say, and the responses of other participants in these conversations;

d. Collects email and text messages sent by you and to you.

You will never be informed when this information is examined by anyone.

Buy a phone. It's cool.


You must tell us everything you do, no matter how trivial. Identify your friends and acquaintances, and how you know them. We expect you to check in with us at least several times a day, every day.


Install apps for Facebook, Twitter, and Foursquare.


Tell us everything you are curious about.


Install apps for Google and/or Bing.


Pay us, because tracking you and sorting through all the information you give us takes time and we need to pay people to do it. Additionally, we need to sell your data to advertisers, marketers, or possibly just hand it over to law enforcement regardless of whether or not they have any legal right to have it, and your data doesn't package itself. Your data is worth money, and you must pay us because we value your data. We value it so much that we will sell it, because that lets us make more money. So pay us. We need to continue watching you.


You will be charged a reasonable monthly fee for these services.

Thank you,

Your new overlords

All of the recent discussion about Facebook's change to its privacy policy obscures one frequently minimized point: privacy doesn't really exist on Facebook. While there is minimal control over what appears onscreen, this should not be confused with real, actual privacy, or the ability to control what is known about you. Facebook has your information, and by virtue of using their site, you have provided them a degree of control over your personal information.

This becomes particularly apparent when looking at Third Party Application developers. These external applications can access data in ways that are not immediately obvious to the end user, and in some cases this seems to work against people's obvious desires. In short: third party applications get the same access as the account that installed them, so if your privacy settings are set to friends only, and a third party app installed by a friend requests your information, it can get it. So, your privacy is as good as your least discrete friend's judgment.

But issues around abusing privacy aren't new for Facebook. They have these types of issues a few times a year, every year. Flash back to the launch of Beacon:

"Facebook still collects your data. Whether or not they show it onscreen or not is only marginally relevant. They have records of how you have used their site, and that information is valuable to people who want to sell you things."

Facebook has a well worn track record of disastrous handling of user data. In the beginning of 2009, Facebook pre-emptively changed their ToS. People were not happy, but people should not be surprised, as this is normal behavior for Facebook.

And Facebook's current "privacy policy" has some gems -- really, there are too many to list, but my favorite is probably from Section 3: Information You Share With Third Parties: "We take steps to ensure that others use information that you share on Facebook in a manner consistent with your privacy settings, but we cannot guarantee that they will follow our rules." Translation: People will get your information through our site, and we don't really have much/any control over what they do with your information.

And, of course, Facebook can change their privacy settings at will, thus eliminating the illusory value of these settings in the first place, as illustrated by this very conversation.

Some other good reads on this:

• The Facebook Blog: http://blog.facebook.com/blog.php?post=197943902130
• Electronic Frontier Foundation: http://www.eff.org/deeplinks/2009/12/facebooks-new-privacy-changes-good-...
• From ReadWriteWeb: http://www.readwriteweb.com/archives/facebooks_privacy_move_violates_con...

Some thoughts after reading this piece in Wired (although this actual blog post could have been written anytime in the last few years).

Let's imagine that the US Government announced that they had started a web site. On this site, you needed to enter your personal information, including an address, and various interests. Once this was done, you could tell the government – via the web site – all about your day to day activities: what you read, where you were going, what movies you like, etc. Then, you could identify your friends, and upload pictures and video of these friends.

This is a small subset of what Facebook users do every day, by choice. Facebook is probably the single largest opt-in surveillance program ever seen. If any government ever tried to build a site like this – even with an ostensibly worthwhile goal, like mapping public services to people based on interest, geographic location, and perceived need – the outcry would be deafening.

Facebook's "services" – and I'm thinking specifically of Facebook Connect – extend that surveillance to what people do on sites outside of Facebook. However, Facebook's internal search – powered by their deal with Microsoft – will provide an enormous amount of raw data about what individual people want. Given that these searches will be conducted by people logged in to Facebook, the search strings used can be mapped to specific individuals. As we have seen before, even a little bit of information about search strings can lead to some awkward revelations.

When people get a glimpse of how much Facebook knows about them, they generally freak out. Yet, the freak outs subside, and people keep plugging away, adding more data into the system.

Okay, time to go. Need to update my status:

Adjusted my tinfoil hat. It had tilted precariously back, exposing most of my frontal lobe.

In an earlier post this year, I held out hope that 2009 would finally be the year where people started taking data ownership and data portability seriously.

As Facebook often does, they help illustrate why this is relevant, and why this is something people should care about.

The fun began a few weeks ago, when Facebook changed their Terms of Service. Last weekend, Consumerist described the specifics of the changes:

Facebook's terms of service (TOS) used to say that when you closed an account on their network, any rights they claimed to the original content you uploaded would expire. Not anymore.

Now, anything you upload to Facebook can be used by Facebook in any way they deem fit, forever, no matter what you do later. Want to close your account? Good for you, but Facebook still has the right to do whatever it wants with your old content. They can even sublicense it if they want.

To summarize, the old version of Facebook's Terms of Service used to specify that, when a person deleted their account, their content went with them (and never mind that the process of deleting an account has proven, well, troublesome for some).

Facebook founder Mark Zuckerberg initially defended the change (does this remind anyone else of the response to Beacon?), but 24 hours later Facebook announced that they would revert to the original terms of service.

But really, the hue and cry over Facebook's terms of service misses the larger point: when you put your data into a hosted service, you are allowing it to slide outside of your control. This is true of most hosted services, including Facebook, Ning, MySpace, etc. Facebook's change of the license terms illustrates a larger point: they control your data. More importantly, sites like Facebook and Ning allow people who have no ties to either company to access your data via third party apps. A quick read through the Developers Terms of Service for both Facebook and Ning show that developers of these apps can access user data and content, but this creates an enormous gray area: if someone deletes their account, what happens to any data collected by these third party application developers? I would love to hear of the mechanisms in place that measure how application developers abide by the rules concerning user data.

So, when evaluating a platform for use by you, by your class, or within your school, department, district, or organization, make sure to read the privacy policy, terms of service, and any applicable third party developer terms of service. All of these affect how the work of people within your site will be treated, and potentially used -- which is especially relevant given that most of these sites include terms that allow for indiscriminate resuse and republication of content posted in the site.

At the risk of stating the obvious, none of these are concerns for sites built using open source tools.

And for those curious about where this ends, it looks like Facebook's interest in user data extends beyond the grave.

I presented earlier today at the Case District VII and VIII conference in Las Vegas. One of the things that struck me as I was getting my notes together for this talk is how using the current/upcoming tools require that organizations staff themselves differently. For example, you can't really write an OpenSocial app without coding skills, and while programmers are easy to hire, writing a good app requires a connection between spotting a need and writing code that addresses it. One of the other differences between where we are now and where we were as recently as a year ago is that people are beginning to understand the value of leveraging their existing community, as opposed to building everything new from scratch. Perhaps online forays, like Kaplan's into MySpace, have been a suitable object lesson in how not to use the social web.